Gnosis Safe
Zafeguard Gnosis Safe components — deploy multisigs, build and sign Safe transactions, manage owners, and batch calls with multicall.
Gnosis Safe Components
Zafeguard provides a complete set of components for interacting with Gnosis Safe multisig wallets — from deployment to transaction execution and owner management.
Public RPC URLs enforce rate limits per IP address and can fail under concurrent load. Use a private endpoint (Alchemy, Infura, QuickNode, or self-hosted). See Connecting to any chain.
BUILD_EVM_GNOSIS_SAFE_DEPLOYMENT_CALLDATA
BUILD_EVM_GNOSIS_SAFE_DEPLOYMENT_CALLDATA Workflow Component
Build the deployment transaction for a new Gnosis Safe proxy. Use GET_EVM_GNOSIS_SAFE_ADDRESS first to predict the counterfactual address.
Config
None.
Inputs
| Field | Type | Description |
|---|---|---|
jsonRpcUrl | string | JSON-RPC endpoint |
owners | string[] | Owner addresses |
threshold | number | Required confirmations (e.g. 2 for 2-of-3) |
saltNonce | number | Nonce for CREATE2 address determinism |
Outputs
| Field | Type | Description |
|---|---|---|
deploymentTransaction | object | Unsigned deployment transaction |
GET_EVM_GNOSIS_SAFE_ADDRESS
GET_EVM_GNOSIS_SAFE_ADDRESS Workflow Component
Predict the counterfactual address of a Safe before deploying it. Deterministic based on owners, threshold, and salt.
Config
None.
Inputs
| Field | Type | Required | Description |
|---|---|---|---|
jsonRpcUrl | string | Yes | JSON-RPC endpoint |
owners | string[] | Yes | Owner addresses (at least 1) |
threshold | number | Yes | Confirmation threshold (≥ 1) |
saltNonce | string | Yes | CREATE2 salt as a bigint string |
singletonAddress | string | No | Custom Safe singleton address (uses canonical default if omitted) |
proxyFactoryAddress | string | No | Custom SafeProxyFactory address |
fallbackHandlerAddress | string | No | Custom fallback handler address |
Outputs
| Field | Type | Description |
|---|---|---|
safeAddress | string | Predicted Safe address (0x...) |
initializerCalldata | string | Encoded setup() calldata used during deployment |
IS_EVM_GNOSIS_SAFE_DEPLOYED
IS_EVM_GNOSIS_SAFE_DEPLOYED Workflow Component
Check if a Safe is already deployed at the given address.
Config
None.
Inputs
| Field | Type | Description |
|---|---|---|
jsonRpcUrl | string | JSON-RPC endpoint |
address | string | Safe address to check |
Outputs
| Field | Type | Description |
|---|---|---|
deployed | boolean | true if deployed |
GET_EVM_GNOSIS_SAFE_NONCE
GET_EVM_GNOSIS_SAFE_NONCE Workflow Component
Read the current nonce from a deployed Safe. Required for building valid Safe transactions.
Config
None.
Inputs
| Field | Type | Description |
|---|---|---|
jsonRpcUrl | string | JSON-RPC endpoint |
safeAddress | string | Deployed Safe address |
Outputs
| Field | Type | Description |
|---|---|---|
nonce | number | Current Safe nonce |
BUILD_EVM_GNOSIS_SAFE_SIGNATURE
BUILD_EVM_GNOSIS_SAFE_SIGNATURE Workflow Component
Compute the EIP-712 typed data hash for a Safe transaction. Pass the hash to SIGN_WITH_KEY_SHARE to produce a valid Safe signature.
Config
| Field | Type | Default | Description |
|---|---|---|---|
mode | 'hash' | 'pre-validated' | 'hash' | Signature mode. 'hash' produces an EIP-712 typed-data hash for signing. 'pre-validated' marks the owner as pre-validated (no off-chain signature needed) |
Inputs
| Field | Type | Description |
|---|---|---|
safeAddress | string | Safe address |
chainId | number | Chain ID (from GET_EVM_CHAIN_ID) |
to | string | Target address of the inner call |
value | number? | ETH value (default 0) |
data | string? | Calldata for inner call |
operation | number? | 0 = CALL, 1 = DELEGATECALL |
nonce | number | Current Safe nonce |
ownerAddress | string? | Signing owner address |
Outputs
| Field | Type | Description |
|---|---|---|
messageHash | string | EIP-712 hash to sign |
safeTransactionHash | string | Safe-domain transaction hash |
BUILD_EVM_GNOSIS_SAFE_TRANSACTION_CALLDATA
BUILD_EVM_GNOSIS_SAFE_TRANSACTION_CALLDATA Workflow Component
Assemble the final Safe multisig transaction calldata from inner calldata and collected signatures.
Config
| Field | Type | Default | Description |
|---|---|---|---|
operation | 'call' | 'delegatecall' | 'call' | EVM call type. Use 'delegatecall' only for module-level operations |
Inputs
| Field | Type | Required | Description |
|---|---|---|---|
safeAddress | string | Yes | Gnosis Safe proxy address |
innerTo | string | Yes | Target address of the inner call |
innerCalldata | string | Yes | ABI-encoded calldata for the inner call |
innerValue | string | No | ETH value for the inner call (bigint string, default "0") |
signatures | string[] | Yes | Array of owner signatures from SIGN_WITH_KEY_SHARE |
Outputs
| Field | Type | Description |
|---|---|---|
calldata | string | Encoded execTransaction(...) calldata — pass as calldata to BUILD_EVM_TRANSACTION |
to | string | Safe proxy address (pass-through, use as to in BUILD_EVM_TRANSACTION) |
value | string | ETH value (always "0" — Safe holds no ETH for meta-txs) |
BUILD_EVM_GNOSIS_SAFE_OWNER_CALLDATA
BUILD_EVM_GNOSIS_SAFE_OWNER_CALLDATA Workflow Component
Generate the calldata to add, remove, or swap a Safe owner, or change the signing threshold.
Config
| Field | Type | Required | Description |
|---|---|---|---|
action | 'addOwnerWithThreshold' | 'removeOwner' | 'swapOwner' | 'changeThreshold' | Yes | Owner management operation to perform |
Inputs
| Field | Type | Required | Description |
|---|---|---|---|
safeAddress | string | Yes | Gnosis Safe proxy address |
owner | string | Conditional | Owner to add, remove, or swap out (required for addOwner, removeOwner, swapOwner) |
newOwner | string | Conditional | Replacement owner address (required for swapOwner) |
prevOwner | string | Conditional | Predecessor address in the Safe's internal owners linked list (required for removeOwner, swapOwner) |
threshold | number | Conditional | New signing threshold (required for addOwnerWithThreshold, changeThreshold) |
Outputs
| Field | Type | Description |
|---|---|---|
calldata | string | Encoded owner management calldata — pipe into BUILD_EVM_GNOSIS_SAFE_TRANSACTION_CALLDATA as innerCalldata |
to | string | Safe proxy address (target of the inner call) |
value | string | ETH value (always "0") |
BUILD_EVM_MULTICALL_CALLDATA
BUILD_EVM_MULTICALL_CALLDATA Workflow Component
Bundle multiple MulticallItem objects into a single batched call. Use with BUILD_EVM_MULTICALL_ITEM and ARRAY_BUILDER.
Config
None.
Inputs
| Field | Type | Description |
|---|---|---|
calls | MulticallItem[] | Array of call items (output of ARRAY_BUILDER) |
Outputs
| Field | Type | Description |
|---|---|---|
calldata | string | Encoded multicall calldata |
BUILD_EVM_MULTICALL_ITEM
BUILD_EVM_MULTICALL_ITEM Workflow Component
Construct a single call entry for a multicall batch.
Config
None.
Inputs
| Field | Type | Description |
|---|---|---|
target | string | Contract address to call |
callData | string | ABI-encoded calldata |
allowFailure | boolean? | If true, a failure won't revert the entire batch |
value | number? | ETH value for this call |
Outputs
| Field | Type | Description |
|---|---|---|
call | MulticallItem | Single item for use in BUILD_EVM_MULTICALL_CALLDATA |
Example: 2-of-3 Safe transaction
GENERATE_KEY_SHARE (×3 owners)
│
├──▶ COMPUTE_PUBLIC_KEY ──▶ COMPUTE_EVM_ADDRESS (owner 1)
├──▶ COMPUTE_PUBLIC_KEY ──▶ COMPUTE_EVM_ADDRESS (owner 2)
└──▶ COMPUTE_PUBLIC_KEY ──▶ COMPUTE_EVM_ADDRESS (owner 3)
│
▼
GET_EVM_GNOSIS_SAFE_ADDRESS (owners[], threshold=2, saltNonce=0)
│
▼
IS_EVM_GNOSIS_SAFE_DEPLOYED? → if not → BUILD_EVM_GNOSIS_SAFE_DEPLOYMENT_CALLDATA
│
▼
GET_EVM_GNOSIS_SAFE_NONCE + GET_EVM_CHAIN_ID + BUILD_EVM_CALLDATA
│
▼
BUILD_EVM_GNOSIS_SAFE_SIGNATURE (×2 owners)
│
SIGN_WITH_KEY_SHARE (×2)
│
▼
BUILD_EVM_GNOSIS_SAFE_TRANSACTION_CALLDATA
│
▼
BUILD_EVM_TRANSACTION → BROADCAST_EVM_TRANSACTION